A campaign abusing cloud-hosted ScreenConnect panels has affected at least 288 endpoints across 48 organizations, according to Huntress. Attackers used the remote-management platform’s Run Command feature to install rogue ScreenConnect clients and a custom toolkit called SCKit on devices managed by managed service providers (MSPs), the company said in its November 11 incident analysis.
Huntress later linked the activity to RMM+, a third-party ScreenConnect extension that lets another tool manage sessions through an API. Versions 1.0.31 and 1.0.32 accepted a blank access key when an administrator had not configured one, bypassing ScreenConnect’s user accounts, roles and multifactor authentication, the researchers said. Huntress found commands associated with RMM+ in the logs it reviewed but no corresponding login activity.
The SCKit toolkit contains 16 files, including PowerShell scripts and batch files, designed to maintain remote access and spread through technicians’ workstations to other endpoints they can manage. It can install a second attacker-controlled ScreenConnect client and attempt to steal a technician’s .aspxauth session cookie for replay against the panel. Huntress said the console-takeover attempt failed in every recovered host log it checked and that it has not observed a successful jump from an infected endpoint to a technician workstation or from that workstation to other endpoints.
Huntress observed the activity beginning at about 17:47 UTC on November 11 and saw all 288 affected hosts within roughly 90 minutes. It reported activity involving remote-management software versions 26.6.6.9747 and 26.7.6.9783.
ConnectWise’s November 12 security advisory says the company has found no evidence that its own infrastructure was compromised or that ScreenConnect itself contains a vulnerability. It disabled five third-party extensions — Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link — in approximately 400 partner environments where it could take action. ConnectWise said the presence of an extension alone does not establish compromise, while the initial access method and full scope remain under investigation. On-premises partners must disable the extensions themselves.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
